MALICIOUS
96
Risk Score
Malware Insights
MITRE ATT&CK
T1566.001 Spearphishing Attachment
T1059.007 JavaScript
The PDF file contains a URL that is likely part of a phishing or malware distribution scheme. The ML classifier and ClamAV detection strongly indicate malicious intent. The embedded URL is the primary indicator of compromise, suggesting the document is a lure to a malicious site.
Machine Learning
- Nyx PDF Classifier malicious score 0.9997
Heuristics 4
-
ClamAV: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 critical CLAMAV_DETECTIONClamAV detected this file as malware: Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
-
External URI info PDF_URIPDF contains an external URL action
-
Object number defined twice with different bodies info PDF_DUPLICATE_OBJ_BODY_INCREMENTALThe same indirect object (N G) is defined more than once with different body bytes. First-wins and last-wins readers will resolve different content, which is a parser-confusion shape used by targeted PDFs. Body-only differences are common in benign incremental updates, so severity is raised only when the duplicate carries active content.
-
Embedded URL info EMBEDDED_URLOne or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.URL https://botokaw.ru/123?utm_term=colicin+membrane+pore+formation
- https://cdn.sqhk.co/wufevinek/iahfWyT/mario_kart_8_stars_after_race.pdf
- http://kosonetibekub.medianewsonline.com/gojefumivogikomutetudaze.pdf
- http://rowexusaje.mypressonline.com/lovipebu.pdf
- http://gupirigugorixuf.sportsontheweb.net/9404408503.pdf
- https://cdn.sqhk.co/pegipoveridi/ieQejc7/34492618469.pdf
- http://jixazepo.mywebcommunity.org/38656946867.pdf
- https://cdn.sqhk.co/tuxonewebuke/hJmNHNU/redeem_code_dunia_games_ml.pdf
- https://cdn.sqhk.co/wujakegu/eijjchc/15071914430.pdf
- https://cdn.sqhk.co/nuduniguwufo/ixgxVPy/amstaffs_dog_simulator_2019.pdf
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://s3.amazonaws.com/datarofapakil/jumibovutuzibuzetibez.pdf
- https://90ff81fc-98d9-4e53-96a3-aaa5c1c2042e.filesusr.com/ugd/bb5aff_10f493bfca7349008b003213e4209db6.pdf?index=true
- http://fijetetesozaw.epizy.com/52059419658.pdf
- https://s3.amazonaws.com/wukevirenesu/38543606807.pdf
- http://zopegekole.rf.gd/torchlight_2_engineer_guide.pdf
- http://kepinud.rf.gd/2727624915.pdf
- https://s3.amazonaws.com/jivala/samsung_j2_6_frp_bypass_apk.pdf
- https://s3.amazonaws.com/fewifuwu/dmv_learners_permit_test_study_guide.pdf
- http://tedijafubivot.epizy.com/raj_bstc_admit_card_2019.pdf
- http://bebidexaroz.rf.gd/how_do_i_put_my_plantronics_bt600_in_pairing_mode.pdf
- https://s3.amazonaws.com/dovulavavo/maths_funny_questions_and_answers_in_malayalam.pdf
- https://eb72eaa1-ef55-40a3-a653-f6d21bccf295.filesusr.com/ugd/54913d_d56a0a20f0fb4f10bf243c2eef1143b6.pdf?index=true
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
- http://ns.adobe.com/pdf/1.3/
- http://ns.adobe.com/xap/1.0/
- http://ns.adobe.com/xap/1.0/mm/
- http://ns.adobe.com/xap/1.0/rights/
- http://scripts.sil.org/OFL
Extracted artifacts 2
Files carved from inside the sample during analysis.
| Filename | Kind | Source | Size |
|---|---|---|---|
font_00_sfnt_off0000eaec.bind1961e4e362a853db29d85aab45f8a6efa504d2b8a5e6bb3047dc421ff0a1c78 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xEAEC | 5028 bytes |
font_01_sfnt_off0000fbea.binea0bf357c55f5ad130eefc7d9306079a9acf2ad856b30874872fb305aa3c9744 |
pdf-font-stream | PDF embedded font (sfnt) at offset 0xFBEA | 10380 bytes |
Open this report in the interactive analyzer, or submit your own file for analysis.